Author: admin

What is Payment Card Industry Data Security compliance?

Posted on by admin

Understand the Payment Card Industry Data Security Standard requirements and how the critical role it plays under placing a robust benefit on successful enforcement of the PCI DSS compliance program.

Developed and launched by the founding payment brands of  PCI Security Standards Council (PCI SSC)  in 2006, the Payment Card Industry Data Security Standard (PCI DSS) is a standardized, industry-wide set of requirements and processes for security management, policies, procedures, network architecture, software design, and critical protective measures.

The requirements stated for PCI DSS compliance are essential to ensure that all entities that process, store, or transmit payment card information maintain a secure environment to prevent any security incident. Though the PCI DSS is not a law, it holds a strong contractual obligation to be applied and enforced through fines or other restrictions – directly by the payment providers themselves.

Here we will have a look at :

  • Overview of the PCI DSS
  • 12 Requirements for PCI DSS compliance
  • PCI DSS compliance  Benefits
  • Difficulties Posed by PCI Non-Compliance
  • Conclusion

Overview of the PCI DSS

PCI DSS has been put forth as the benchmark standard compliance program for the security and protection of the cardholder data, The standard applies to any business IT system or operation that involves any stage of storing, processing, or transmitting the cardholder data. Successful implementation of the controls defined under the PCI DSS makes it more difficult for the attackers to steal sensitive data promoting security and assurance to multiple parties involved in the payment processing cycle like Payment Card Brands, Issuers, Merchants, and Acquirers, etc.PCI DSS Implementation does not require any special grade countermeasures but focuses on placing a minimum baseline to help organizations defend their business against their attackers.

Aiding the successful implementation of the  PCI DSS compliance program, the PCI SSC council has provided a set of resources to aid any organization that seeks to implement or attain  PCI DSS compliance. Along with other key documents, the security council has provided:

  • PCI Data Security Standard quick reference guide and approach
  • PCI Software Security Framework  and a list of Validated Payment vendors and applications under its Secure Software Standard and Secure Software Lifecycle Standard to help payment software vendors adhere to security practices in the development cycle and software.
  • PCI PIN Transaction Security (PTS) requirements for device vendors and manufacturers, along with a list of approved PIN transaction devices
  • Self-Assessment Questionnaires templates in aiding organizations to validate their PCI DSS compliance.
  • List of Qualified Security Assessors (QSAs) for the multiple compliance standards
  • List of Approved Scanning Vendors (ASVs)
  • An Internal Security Assessor (ISA) education program

The council also provides resources for Card production, PIN, TSP (Token Service Providers), and contactless payments, etc.

12 Requirements for  PCI DSS compliance

The PCI DSS compliance program has seen major changes over the years, The latest versions  groups the  12 PCI DSS requirements, in the six principles stated are as follows:

Implementation of Secure Network Infrastructure

  1. Install and maintain a secure firewall
    Network firewalls can be software or hardware technologies that provide the first line of defense to a network. Firewalls can restrict incoming and outgoing network traffic
    through rules and criteria configured by your organization. Being the first line of defense against cyber threats and their effectiveness, firewalls are required for PCI DSS compliance.
  2. Password protection policy
    Implementation of adequate configuration standards for networking devices and applications in the enterprise is necessary. Using third-party products with generic passwords lowers the effectiveness of the security measures, making the systems easily accessed by the public. IT heads need to maintain and update asset inventory along with a strict policy for password usage and configuration, to ensure PCI DSS compliance.
    Secure Cardholder Data
  3. Protect Cardholder data
    The third requirement is designed to minimize the impact of an attacker managing to compromise your network and system components to gain unauthorized access to your data stores. To effectively reduce the risk of unauthorized access, it is necessary that data retention is kept to an absolute minimum and the stored data is protected using Encryption, Tokenization (with effective supporting practices), and so on.
    Regular scanning and maintenance of the cardholder data environment are required to ensure that no unencrypted data exists, to maintain PCI DSS compliance.
  4. Encrypt cardholder data across the network
    Much like “Cash In Transit,” cardholder data is sent across multiple channels as per requirement. This makes it necessary to ensure that the sensitive cardholder data is encrypted when transiting over public-facing environments.
    Maintain a Vulnerability Management Program
  5. Install and maintain an antivirus program
    Cybercriminals are constantly evolving malware strains, hence all the devices that require an antivirus program must be installed. The program needs to be patched and updated regularly. With evolving security requirements, it’s essential that asset security programs remain updated and to ensure that the controls remain effective.
    The audit logs help you to verify compliance with PCI DSS assessment, without which one would be unaware of an unauthorized browser extension or malware that can read PANs as they are entered into a payment application. 
  6. Maintain strong system and application
    Application developers can never be perfect hence it is necessary to update/patch security holes, a cybercriminal will pass the security vulnerabilities across the hacker community to exploit the weakness until the systems are patched. The software development process must be carried out securely to ensure no new vulnerabilities are introduced.
    All changes must be managed, to document the supporting risk-based
    decisions made (e.g., Impact, Rollback options, etc. The updates are necessary for all software on devices that are used to manage cardholder data.
    Implement Strong Access Control Measures
  7. Restrict access to cardholder data
    Isolating access rights is nowhere crucial than the payment cardholder data. The merchants need to ensure that managing employees grant access rights to the least amount of data that are necessary to perform any action.
    It’s necessary to establish an access control system for each element of the cardholder data infrastructure, and all access rights must be set by default to ‘deny all’ unless an individual is specifically allowed access to designated cardholder data.
  8. Authentication policy for access to system components
    Any person who has access to cardholder data should have individual credentials for access identification. Unique IDs and authentication methods (passwords/token devices/biometrics) should be used for everyone. Prohibit shared/generic accounts and implement Two-factor authentication for remote access.
  9. Restrict physical access
    Merchants need to restrict physical access to cardholder data or systems that house cardholder data – including hardcopies, stored in a secure location to manage PCI DSS compliance.
    The card environment should have physical security controls and procedures for the identification and management of any visitors to the premises.
    Regularly Monitor and Test Networks
  10. Monitor and maintain access logs
    All activities concerning handling and managing cardholder data need to have a log entry associated with them. The logging mechanisms are necessary for vulnerability management. Merchants must create a process that links all access by individual users to
    cardholder system components that will enable you to reconstruct and record events.– especially when done with administrative privileges.
    The ability to produce detailed audit reports on demand is important for  PCI  DSS  compliance.
  11. Regularly test security systems and processes
    New vulnerabilities are discovered daily and hence PCI DSS requires merchants to regularly test cardholder data systems and processes to find those vulnerabilities and fix them.  Vulnerability scans  for both internal and external networks (at least quarterly) and penetration testing (network and application layer) are required.
    Network and host-based IDS or IPS are to be managed and maintained along with a system to monitor file integrity.
    Maintain an Information Security Policy
  12. Document and maintain policies that address information security for all personnel
    PCI DSS compliance  requires merchants to maintain a policy that addresses information security for all personnel. The policies determine the nature of the controls used to ensure security and comply with PCI requirements that apply to each component in the cardholder data environment like – PIN entry devices, servers, network services, applications, PCs, and other endpoints.

PCI Compliance Benefits

Cybercriminals are opportunists that seek to exploit the misinterpretation/misapplication of the PCI DSS controls, poorly managed PCI DSS oversight, bad practices, or poor risk management processes. Even though the process of complying is a very daunting task, yet its importance is growing over time. The process of gaining  PCI DSS compliance  with the right tools can be completed with ease even considering the maze of standards and issues.

The compliance benefits can be counted as follows :

  • Ensure system security and develop customer trust, confidence and manage system security that ensures trust for businesses
  • Reduce the risk of security breaches by ensuring application security and loophole closure concerning Cardholder Date and Cardholder Data Environment.
  • An increase in business prospects as being the  PCI compliance  stature promotes one as a secure business ensuring growth in reputation.
  • An organization that complies with PCI DSS should be able to decrease the data breach significantly. Being compliant with PCI DSS ensures that the company has a strong commitment to protecting its data, improving customer relationships.
  • Gaining  PCI DSS compliance  will prepare you better with other privacy and regulation standards like ISMS,HIPAA, SOX,  GDPR, etc.
  • Successful implementation will lead to the overall improvement of IT infrastructure efficiency.

Difficulties Posed by PCI Non-Compliance

PCI DSS compliance is treated as an annual “tick box” audit however, this is far from reality where PCI DSS should be treated more like having the responsibility for owning and running couriers, road haulage, or taxi services. The increasing dependency on electronic payment systems has increased its regard in the eyes of cybercriminals. This ever-growing trend toward payment cards increases the potential opportunities for criminals to exploit poor practices.

Failing to noncompliance would result into :

  • Data breach incidents that affect consumers, financial institutions along with severe damage to the company brand.
  • In addition to the loss of brand reputation, a merchant should expect their revenue to drop drastically owing to the loss of clients followed by a security incident.
  • Legal actions, insurance claims. government fines and lawsuits and canceled accounts.

Conclusion

The PCI DSS compliance poses a challenge to every business that’s not rightly prepared and looking forward to gaining the PCI DSS compliance status. PCI DSS continues to evolve based upon mature and well-established industry best practices. Consequently, to repay the consumer trust and to reduce the attractiveness to criminals, businesses must understand the heritage of the PCI DSS controls to better enable them to develop robust defenses.

Acing the SOC audit with ideal documentation

Posted on by admin

Creating evidence of significant operational activities and documentation of processes is a prerequisite to achieving compliance in an organization. It is the first and foremost step in any audit process. The SOC 1 and the SOC 2 audit processes are no exemption to this age-old practice. Any organization aiming to achieve compliance through the SOC reports must ensure that proper evidence is documented and presented during the audit. This generally includes providing documents that emphasize the various ways in which the organization has formed policies and guidelines with the compliance requirements in mind. It must also highlight that such policies are actively in practice.

The SOC 1 audit requires documents that are related to the internal controls of financial reporting, while the SOC 2 audit might require documents that emphasize trust principles. The nature and kind of documentation differ based on the audit the organization is subjected to.

Read through to learn how to ace the documentation process of the SOC audit:

System Description:  This is a document that is handed over to the auditor before the audit process. This is a description provided by the management about the organization’s systems, policies, processes, system infrastructure, and controls placed. While this report is often referred to as “Management description”, it is not necessary that it needs to be highly descriptive. Appropriate details must be provided with enough information about key policies, day-to-day process flows with flowcharts, or any tools for easy illustration.

It is always better to highlight how the compliance requirements like the trust principles, etc. are implemented to smooth delivery of services along with compliance. As this document is generally handed over well in advance, the organization must take caution if any changes are to occur in the systems.

Documentation for user entity controls:

These are reports which align the organization to the control objectives and requirements of the SOC audit as these illustrate the efforts of the organization which are implemented at the user-entity level. This documentation is descriptive about how services from third-party are secured for processes like auditing, services related to the cloud, transaction-level activities involving other organizations. Details like service level and user entity commitments must be provided as they are crucial to the organization. It is to be noted that all the processes implemented to exercise control objectives within the organizational operations must be included in this document like access and data process in information systems, monitoring processing errors, carrying over important reconciliations.

Documentation for technical security:

This documentation is done including all the physical devices used within the network of the organization. It can be described as a list of all the physical devices, all the records related to the maintenance of such equipment, plans for data security and security measures like configuration of the system, methods of data retention used, methods of data deletion, access management system, password policies, etc.

It is suggested to include major records maintained like system access logs, system backup records, patch records, security of key controls which ensure the protection of data. Any data which is related to the management of systems and devices with an infrastructure must be documented and reported.

Documentation for operational activities:

It is crucial to document the process flow of day-to-day activities done in the organization in the form of flow diagrams, control documents, risk management plan workflow, any compliance routine, data privacy practices, usage agreements, and confidential agreements.

Documentation for human resource management:

Human resource management in an organization involves activities like creating an organizational hierarchy chart, assigning clearly defined roles for every hierarchy created, having a list of roles and responsibilities of all the employees, putting a compliance process in place, creating security awareness, distribution of employee handbooks for operational practices. Apart from such day to day activities, the human resource must also have a well structures process aligned for the hiring of candidates, onboarding of new employees, evaluating employee performance, terms and conditions for employee termination, proper surrender of access to physical devices and system applications, action applicable on violation of company policy, transfer of department and change of positions for existing employees, code of conduct, manuals for standard operating procedures for information security, corporate governance and code of conduct.

All the processes carried out day in and day out, as well as monthly, annual practices as mentioned above, must be documented and presented with complete information.

Documentation for administration and security policies:  It is of utmost importance to document the mandatory policies which are formed in the organization at the time of inception or at the time of risk management planning like the organization’s administrative policies, the information security policy, the business continuity policy, incident management policy, disaster recovery policy, policies for access management, etc.

Documentation for risk assessment:  Documents related to any assessments done previously like risk assessment reports, third-party audit reports, assessment questionnaires, vulnerability tests, or any other audits or risk assessment tests done must be documented and presented in the SOC audit. Audit findings if any from the previous audits must also be presented along with the corrective actions implemented. Below are a few pointers for an ideal risk assessment report:

  • Identification of threats
  • Possibility of threats and impact of possibility.
  • Steps to mitigate the risks identified
  • Plan of action and additional precautions to be taken
  • Policies to involve all departments in the risk assessment process
  • Communication of risk across the organization

Conclusion

An organization aiming to achieve compliance through the SOC audit must look forward to and be ready for a huge amount of documentation and evidence presentation as both SOC 1 and SOC 2 have their requirements to be met as part of the SOC assessment process. In such a situation, it is better if the organization has a repository of all documentation stored and maintained. This ensures ease in the audit process for the auditor and the organization, as all the documents will be already present and available for the auditor and any case of missing documents can be identified well in advance and necessary action can be taken accordingly by the auditor. If this practice is followed in the long term, the organization can even bring best practices for documentation and can ensure that there are no gaps in documentation in the coming years.

We at QRC can help you get your documentation ready for the SOC audit. It requires a flawless presentation of the organization’s documentation to get through the SOC audit. Through our SOC assessment services, we can help you align your organization’s documentation to the requirements of the SOC, and this way your organization emphasizes that you go through flawless documentation, assessment, and audit. When there are no gaps in documentation, compliance, and audits are a no-brainer !

Cybersecurity Challenges using IoT / IoMT Health

Posted on by admin

The healthcare industry has seen rapid changes in the past few years, especially with the advent of IoT devices that have been evolving at a faster pace. We have seen considerable development, even having a long way to go. The pandemic fueled rapid adoption, revealing the vulnerabilities, and inefficiencies in this sector.

While major IoT healthcare initiatives currently revolve around telemedicine and remote monitoring, the upcoming phase had a broader scope like tracking, monitoring and maintaining medical equipment and healthcare assets etc. Applications like personal healthcare, biosensors, smart beds, smart pills, the health insurance industry, robotics, and other specializations have just expanded the scope of IoT, and we haven’t talked about the pharma industry yet.

Benefits of IoT Healthcare

The ongoing pandemic clearly paved the way for faster adoption of the IoT devices and tele healthcare services. The key advantages of having IoT in healthcare are :

  • Medical Mobility :  When more patients need urgent assistance, it becomes necessary for the medical staff to track and maintain records of even hundreds of patients, serving in real time. IoT helps in tracking and getting alert when any critical change in a patient’s parameter occurs, aiding in locating and providing direct assistance asap.
  • Patient Data Processing :  Medical professionals tend to spend hours processing different kinds of medical information, Coupled with ML, IoT can excessively reduce these efforts to a few minutes, additionally offering possible treatment options.
  • Enhanced preventive medicine, by better understanding conditions (courtesy of IoT data) and providing timely diagnosis without awaiting for obvious symptoms.
  • Mass reduction in risk of error and miscalculation due to  human factors.
  • Medical Apps  for monitoring critical health issues, aid healthcare professionals in finding out whether the  patient has taken the prescribed medication else, the therapists can call and remind a patient. The whole process can be automated.
  • Under secure practices,the personal data can be directly transferred to the doctor, maintaining  confidentiality,  as the information is moved from one device to another.

The IoT devices collect and transfer health data like the blood pressure, oxygen and blood sugar levels, weight, and ECG readings etc. With the increase in consumer engagements and consciousness regarding their health and better quality of life, there is a surging demand for remote healthcare services aiming to provide a better quality of life. While industries are approaching to provide a more integrated and IoT enabled healthcare solution, these industries have their own set of challenges, a larger amount of which is considering the security threat and privacy challenges.

IoT / IoMT Threats and security challenges

With the increasing market share of the IoT devices in the healthcare field, it has offered a simple door for cyber criminals trying to misuse and profit from device vulnerabilities. Ransomware tops the list of cyberthreats for healthcare organizations.

IoT Device security challenge 

The IoT concerns a wide range of modules like the data acquisition,communication, sensors etc. Owing to the lack of consideration of cybersecurity threats, they have an inherent technical debt which results in compromised medical devices with unpredictable behavior.

Network Segmentation
Most of the healthcare organizations  lack network segmentation  and  access control  of IoT, owing to this any new device introduced will have global organization access, especially to lateral moving sensitive patient information in the network channels. Lack of NATing, allows a IoT device with default configurations to be discover able on the internet.

Use of Legacy systems
Legacy systems cannot be patched or updated as this interferes with the provision of patient care that’s essential 24/7. As these systems are devoid of any new security updates, they greatly facilitate the work of attackers in formulating IoT security breaches,

Mediajacking

Security threats that are owing to the implementation of malicious media to gain access to the medical device fall under the category of media jacking. Once the software is accessed, the attacker can vary the injection quantity to potentially cause lethal damage to the patient, additionally stealing confidential information.

User Impersonation

IoT devices capture data in real time and are a treasure trove of patient data for cybercriminals. Most of the devices lack a data protocol or standard, also the use of open source softwares. The data can be misused to create fake ID using the sensitive information like medical history and social security number, to buy drugs or equipments to sell later or file a fraudulent insurance claim

For any IoT device or environment implementation, apart from  side-channel attacks, following are the key vulnerable areas in IoT device :

  1. Traffic Interception
    Use of legacy systems and network segmentation increase the chances of data drain of confidential data from a secure network while transmitting information to a healthcare’s IoT system.
  2. Debug Port
    Physical devices essentially come with a debug port used for development or debugging purposes. But they can also provide access to attackers to read, high jack or modify the firmware.
  3. Authentication and Authorization
    Secure authentication and authorization mechanisms are necessary to ensure the protection of data against any hacking attempts.Most of the IoT devices come with a device with a default password, which are necessary to be updated to avoid ease of access to malicious hackers.

Considering security as an ‘add-on’ feature in device acquisition
Most of the activities in the device acquisition and implementation phase consider security just an add-on feature, leading to an increase in the risk of human error and poor system configuration. Even the unregulated practice of BYOD, especially by physicians belonging to independent medical groups.

Security concerns while developing IoT apps
While lightweight, developer friendly APIs are the need of the hour, the advent of IoT devices has brought a whole new challenge for IoT security developers. The following are few risks associated with the IoT app development, seen over recent years.

Data Breach Continues To Crash Down Organization

Posted on by admin

This article is part of our ISO/IEC 27001 certification hub page, which explains how organizations can strengthen information security and reduce risks through a structured management system. Data breaches can disrupt operations, damage trust, and create serious compliance challenges, making ISO/IEC 27001 an important framework for identifying risks and improving security controls.

According to the latest news reports, leading multinational pharmaceutical companies, playing a key role in affordable and innovative medicines, suffered a massive data breach recently.

The research labs had exposed sensitive data of millions of patients, including COVID -19 test results along with their booking details such as their name, address, phone number, email id, payment details, digital signature and the medical tests prescribed.

Breaches as such occur, as a result of unauthorized access to the system for accessing sensitive information. It could be due to unprotected networks and processing systems and lack of best security and privacy practices in place. In the wake of such incidents, it becomes mandatory on the part of all businesses to make data security as their highest priority.

The data breach has been a sharp reminder of the need to adopt security standards and  data privacy  frameworks like  ISO/IEC 27001, HIPAA, GDPR  etc to strengthen the digital infrastructure and tighten cyber security control measures of the business organization especially for ones that expand to multinationals. Adherence to these will help to minimize any security incident that would have a major impact on business operations.

The growing risk of attacks on the business and security weakness emphasises organizations the need to secure and safeguard people, process and technology.

At a minimum, organizations should think to implement and perform regular Vulnerability Assessment and Penetration testing (VAPT) practices to understand and evaluate immediate risk.

Vulnerability Assessment  is a process of discovering a system’s vulnerabilities, by having an in-depth evaluation of security weaknesses that affect an information system that is present internally and/or externally.

Penetration testing  (commonly referred to as pen testing) is the process of actively checking your business application and systems to determine if potential vulnerabilities can actually be exploited, performed under controlled conditions, simulating scenarios representative of what a real attacker would attempt.

VAPT is the Norm for Security Testing:

Pacing with lightning speed with new testing methodologies, the two significant tests namely Vulnerability assessment and Penetration testing provide an integrated view of threats while locking the scope of vulnerabilities.

Still thinking why consider VAPT ?

  • Avoid Unauthorised access:  Testing current security posture can expose security posture under controlled circumstances. It helps us identify the current loopholes, so that they can be efficiently addressed.
  • Infrastructure under control:  VAPT can identify vulnerabilities inadvertently introduced during changes to the environment, such as a major upgrade or system reconfiguration.
  • Security under Surveillance:  Organizations, especially those acting as data custodians, are being required to showcase their efficient security posture to their customers. Penetration testing can demonstrate a commitment to security from a customer perspective and provide attestation that their assets or services are being managed securely.
  • Risk Management:  VAPT is a common requirement for internal due diligence as part of ongoing efforts to manage threats, vulnerabilities, and risks to an organization. Results can be used as input into an on-going Risk Management process.
  • Protect Business.  VAPT allows companies to proactively assess for emerging or newly discovered vulnerabilities that were not known.

Ohhk, but how to proceed with VAPT ?

VAPT assessments require a clear methodology and planning, a few key steps involved are as follows :

  • Planning the scope  – Decide which systems components (network devices, servers, security devices, applications etc) either accessible from external or internal will be included in the scope of testing.
  • Vulnerability Assessment  – Perform the assessment by using various testing methods and tools to identify potential vulnerabilities and threats to the scoped systems.
  • Exploitation–  The valid vulnerabilities are exploited further to check for the extent of information gained and impact on the  specific system with respect to the confidentiality, integrity and availability.
  • Reporting  – Results from VAPT testing must be analysed,confirmed and documented. This includes recommendations and prioritization of threats that need to be addressed.

If there is a data breach in customer data, then organizations will have reputational damage which can be devastating. Studies have shown that almost a third of customers from retail, finance and healthcare will stop doing business with organizations if their data has been breached. So, it is always better to have a robust security and privacy systems and good VAPT practices in place.

PCI DSS Certification – Common Controls failures

Posted on by admin

Data breach incidents are becoming incredibly common, and a significant reason behind it is organizations careless in taking necessary precautions in securing their vital network and systems. The revenue loss stats from last year mount up to  $24.26  billion let alone due to payment card fraud.

PCI Data Security Standard or PCI DSS as it is abbreviated is a set of technical and operational requirements for any organization that accepts, stores or transmits any cardholder data in a payment processing ecosystem. The standard serves as a guideline for organizations to up their defences and significantly reduce the chances of suffering from any data breach incidents that cost in reputation and revenue.

Read about the  PCI DSS  standard here.

In a survey taken last week on the most common pain point in the implementation of PCI DSS, 57% of the audience voted for accurately defining the scope for the assessment. These inconsistencies eventually end up in security loopholes that hackers exploit and get their hands on the sensitive card data.

Common Failures in PCI DSS Implementation :

Inaccurate Scoping : 

Accurate scoping of the cardholder data environment is necessary. In a survey taken last week on the most common pain point in the implementation of PCI DSS,  57%  of the audience voted for accurately defining the scope for the assessment. These inconsistencies eventually end up in security loopholes that hackers exploit and get their hands on the sensitive card data.

Scoping of the cardholder data environment (CDE) will include all the aspects of people, process and technologies that are involved in handling the cardholder data. Organizations reduce the PCI DSS scope by means of  network segmentation however, threat actors would be able to enter from a less secure area if the segmentation is done improperly.

Storage of sensitive authentication data (SAD) :
Many organizations unawarely store sensitive authentication data even after authorization. PCI only allows  SAD  for payment processing, and no data is to be stored post-authorization.

Default System Credentials and Settings :
Post workstation and device setup, default system settings and passwords are mandated to be changed, failing this leaves open doors for the system access for hackers

Outdated Security Patches :
Technology is ever-evolving, and hence any software application has a short life cycle, the one that is sustained by ongoing updates and upgrades. Hence having outdated security patches still running on the system opens considerable risks and vulnerabilities.As per the PCI requirement, it is necessary to keep the system security patches updated.

Poor Encryption Key Management Policy :
Modern cryptographic algorithms, when implemented correctly, are highly resistant to attack – their only weak point is their keys, and the biggest challenge is the efficient utilization of encryption and tokenization.

The value of any cryptographic key is equivalent to the value of all the data and/or assets it is used to protect. It’s necessary to adhere to the essential controls regarding Key storage, policy management, authentication and authorization.

Inefficient Log Management :
Insufficient logging has been the bedrock of nearly every major incident. The lack of monitoring and timely response helps attackers to achieve their goals without being detected. Hence it is necessary to ensure that audit trails for all the essential processes like Individual usage with cardholder data, administrative activities, invalid access attempts, tracks of audit log clearings and access restrictions for jobs related.

Insufficient Monitoring Policy :
Attackers rely on the lack of monitoring and timely response, in order to achieve their goals without being detected. Consistent monitoring, regular log review, usage of IDS / IPS, conducting Quarterly vulnerability scan and change detection mechanism are few steps to implement efficient monitoring mechanisms.

Poor Access control policies :
Improper access control policies expose an organization to unauthorized access of data and programs, fraud, or the shutdown of computer services. As an organization’s network extends board, external threats become more critical to be considered while implementing security measures.

Failing to address PCI DSS compliance in Quarterly or Semiannual security assessment:
Once PCI DSS certified, organizations tend to fail to continually address the compliance requirements in their quarterly or semiannual security assessments. As a part of business, as usual, it’s necessary to flag and investigate any exceptions that occur in the course of daily operations.

Key Steps To Prioritize Cybersecurity Risk Management

Posted on by admin

COVID-19 pandemic has largely affected the way industries used to operate. A major portion of the industry has moved on to hassle adoption to remote working. These changing and emerging trends in operations and information systems have made it critical for management and stakeholders to understand new organizational challenges and have collaborative solutions to defend against the growing cyber threatscape. The pandemic has gifted attackers and even nation-state groups in leveraging the situation for targeted campaigns.

As an organization, it is important to adopt resilience and prioritize cyber preparedness along with the key mission-critical activities. Cybersecurity Risk can be overwhelming, considering the potential of disaster. Threat actors are always seeking new doors and move in to plunder your most valuable asset, your Data

The rush to digital adoption in these uncertain times for organizations that have relied on legacy technology is currently facing an unprecedented issue when it comes to cybersecurity risk management.

  1. How to determine the newly evolved cybersecurity posture.
  2. How to efficiently direct their resources to mitigate the risks posed by the gaps.

Managing these form a key portion of an effective cyber risk management program, evidently essential during this pandemic time in an increasingly digital world.

  1. Deep Dive In Your Current Cybersecurity Posture And Identify Your Security Gaps with the “new normal”
    Organizations need to analyze their critical infrastructure as to how their security posture has changed. Especially critical services sectors need to fast pace on this aspect and the leadership needs to identify the new change since any failure in identifying the new blind spots will lead to potential losses.

    Identifying your current posture is especially the most difficult part of the information security management process. The leadership with a clear understanding of the impacts of security risk and willingness to expose even their failures in implementing a secure digital transformation initiative are of immense value.

    Organizations can refer to voluntary frameworks like the  NIST Cybersecurity Framework.  These frameworks will aid the CISOs in understanding where they stand by assessing the compliance and security controls defined by these frameworks. The leadership should focus on building a cyber risk strategy by identifying risks across multiple aspects of the technology and operation, while planning along with the organization’s objective.

  2. Mitigate the Security Gaps by Improving the current Process
    Identifying the current gaps is one part of the process, after that the team should focus on closing the gaps disclosed in the most efficient way possible. Mitigation of these gaps does involve a lot of fuss and activity namely the email chains, the Q& A session with multiple teams, and the spreadsheets.

    In these scenarios, the leadership should step in and communicate the stepwise approach and optimize the entire workflow by using audit-ready templates and automation. Prioritizing risks effectively and efficiently by the best-known practices must be the forte as they aid in combating the known threats in multiple areas of business continuity and security. CISOs and CIOs need to standardize processes that can be implemented rapidly.

    Prioritizing the mitigation process and implementing resilient systems will help in understanding accurate data and making informed decisions for cyber risk management activities.

  3. Facilitate Adoption of New Technologies and Effective Processes, promoting Culture ChangeEven in dire today’s situations, the pandemic has thrown an opportunity for a massive paradigm shift in working culture which would have taken longer to adopt under normal circumstances. But switching to new technologies isn’t just sufficient for managing the cyber risk efficiently. As an organization,the management will need to focus on translating the cyber risk in terms of business in this era of digitization.

    Roles like Digital Risk officers can serve for assessing the risks related to new products and services in the truly digital age along with focusing on the areas of cyber risk and compliance management aligned with the business goals. The organizations should seize this opportunity in creating a clear, concise, and actionable cybersecurity program and support their efforts to build cyber resilience.

    Following the three-step process,  organizations can align their cybersecurity goals and fix their cybersecurity posture to avoid a fallout during an unforeseen security incident. With a clear understanding of the requirements and use of modern solutions, organizations can measure the impact of cybersecurity compliance and  risk management. The leadership should focus on building a culture of cybersecurity resilience and productivity.

PCI SSC council announces updates for PTS POI.

Posted on by admin

PCI SSC announced and published new updates in the PCI PIN Transaction Security (PTS) Point-of-Interaction (POI) Modular Security Requirements v6.0 standard. With new advancements made in the payment ecosystem, new applications and payment device technology, it’s necessary to safeguard and secure controls against cybercriminals who are developing new ways to breach systems storing sensitive payment data.

The PTS POI standard was developed to protect the PINs and cardholder data on magnetic stripe or the chip of an EMV card used along the mobile device. The latest version 6.0 includes key requirements and changes related to :-

  • Restructuring key modules into Physical and Logical, Integration, Communications and Interfaces, and Life Cycle to reflect the diversity of devices supported under the standard and the application of requirements based upon their individual characteristics and functionalities.
  • Ensuring ongoing protection by limiting the firmware approval timeframe to three years.
  • Including requirements for devices that accept EMV enabled cards to support Elliptic Curve Cryptography (ECC), facilitating the EMV migration to a more robust level of cryptography.
  • Enhancing support for accepting the magnetic stripe cards in mobile payments using solutions that follow the Software-Based PIN Entry on COTS (SPoC) Standard.

The in detail documents related to the PTS POI v6.0 Standard has been updated at the  PCI SSC document library. The documents are as stated below:

As a forerunner on the cybersecurity front, QRC supports their customers to establish, document, implement and maintain Data Security and Privacy frameworks to protect their sensitive data from all Internal / External Threats and manage the confidentiality, Integrity, availability, Security, Privacy of such information systematically.

Merchant’s guide for payment security requirements

Posted on by admin

Ecommerce, online payment transactions are advancing their path in this developing technology. The customer is concerned with the payment security and that the bank credentials are maintained in a confidential way. To develop a good merchant customer relationship the merchant needs to provide payment security to his customers. They need to ensure that the best payment security measures are taken and that customers don’t need to worry about their data.

Few steps as stated can be taken to manage risk and provide a secure online service :

Getting PCI Compliant

PCI DSS is a set of comprehensive requirements developed by the founding payment brands of the PCI Security Standards Council, to enhance payment account data security. The standard is applicable to any organization that accepts, stores, processes and/or transmits cardholder data, whether you are a merchant, acquirer bank, credit card processor or a payment card brand.

The PCI DSS standard includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures. By complying with PCI DSS requirements, merchants meets their following obligations:

  • Development of Consumer Trust in the Security of their Sensitive Information
    If the customers feel that they are “safe” with their merchants, it helps grow confidence in the services. Confident customers are loyal and they share their experiences with others
  • Reduce Direct Losses and Operational Expenses.
    Adequate data security protects cardholders and limits risk exposure,minimizing the losses and expense that might stem from compromised cardholder information.
  • Maintained Positive Image
    With Information security at the center of everyone’s mind, data loss or compromise not only hurts customers, it can seriously damage a business’s reputation. Compliance with PCI DSS manages to reduce the risk of breach considerably.

SSL protocol

Customers should be ascertained with trust and peace of mind when they are using e-commerce websites. Hence, it’s necessary to implement SSL protocol on the payment application as the first thing crucial for your payment security. SSL helps us to encrypt information that goes on the site such as credit card details and sensitive data that customers share during the checkout process. Transport layer security (TLS) provides a trademark for all E-commerce websites as it verifies the data transaction whatever happens is safe or not.

The identification of an SSL protocol is to check whether the payments page on the internet shall start with https:// and the padlock icon visible in the URL bar next to your web address. This builds your credibility as a secure service provider

Tokenization

Tokenization initiates secure payments and it is very much difficult to engineer the card details from the token. Tokenization reduces the PCI to strive hard for secure payments  and optimises the cost. The customers can store the card information in their e-wallets without exposing their original card information. Merchants accepting the recurring payments can get habituated easily and also offer quick mobile payments and easy purchases.

Rise of the Cerberus, financial institutions warned ahead

Posted on by admin

Named after the monstrous wrath dog of the underworld from greek mythology,  Cerberus  is a banking trojan, created by the remote attackers which allows it to steal the account data, SMSs and all other important data of the device.

Taking advantage of the ongoing pandemic situation, scammers are targeting the financial data of the users’ smartphones.  Cerberus, the malicious software is being blessed with the amid pandemic scenario impersonates and sends SMSs providing some content and links that might deploy it’s malicious app by usually by sending emails pretending that they are from reputed companies and procuring the personal data that reveals the financial credentials of the customer. Recently on Tuesday the CBI announced that this kind of trojan often tends to be tricky for the users as they ask to provide the authentication details.  CERT  recently issued a security notification regarding zoom stating it as not a safe platform for the usage of individuals. The cerberus is more impacted to the internet users who are involved in the work from home jobs.

Impertinent behaviour and speed of criminal activity has been increasing from the time since our prime minister Narendra Modi has announced about the PM cares fund for helping the victims of  COVID-19  pandemic. Various cerberus attacks have been phished off to transfer money in the name of treating patients. Fraudulent E- commerce sites have developed rapidly promising to treat corona victims.

The investigator could face the challenges like sending email to susceptible people for sharing password and bank credentials. Meanwhile the fraudsters are surging their way through the meeting places of corporate offices like google hangout and zoom. Some of the advisories warned that usage of open WiFi networks is dangerous also changing the default passwords would reduce the risk of the crime happening forth.

Operation Pangaea was launched by the  INTERPOL  to eradicate this kind of malicious software and nearly around 120 criminals from 90 countries which would worth around 14 million dollars were caught by them but this has not been executed in Indian government didn’t have any such kind of execution for such kind of issues. Slew of malicious software has become a banking trojan exploiting the name of coronavirus.

Cerberus makes use of an overlay top display of an actual mobile banking app and can trick the users into entering their banking credentials into the fake login screen. All the financial data can be acquired by the remote attackers. Such kind attacks are done for unique targets and banking apps. When the cerberus trojan gets installed in your device it doesn’t show any icon for the application to the user. It pretends to act like a flash player in order to gain permission from the system.

By chance if the software gets installed due the lack of security it automatically registers the command and control over the systems. To robb the credential information of the device it launches remote screen overlay attacks. This impinges the customers to provide their details on some of the websites with fake login screens. The victim totally gets devastated by all the credential data over their respective devices.

To be safe from such malicious practices one should beware of downloading the applications as this malware relies on social engineering tactics to make its way onto a victim’s device. Click the links from trusted sources, if you receive any suspicious link stay cautious and avoid interacting with the message. Using an antivirus software would be more adorable to protect from such harming trojans.

Software files especially from the third party unofficial sites shady sites, third party downloaders, Peer-to-Peer networks, freeware download pages, free file hosting sites, etc., can be and often are used to proliferate malicious programs. Third party, fake installers are often used to spread malware too. If the above precautions are taken care off the malicious software could not be encouraged and there shall be no threat for the users credentials.

Delivery attacks the increasing of payment fraud

Posted on by admin

Ongoing Corona Crisis have led to a spike in the number of fraudulent transactions and cybercriminals nowadays are sitting tight to exploit the new avenues. Reports spurred in showing the increasing curve of the fraud attacks and how even AI and ML technologies alone are proving ineffective against them. Ecommerce has been the major target, apart from the prevalent areas of cards and user accounts.

Pandemic has unfortunately led to increased “Delivery Attacks” that target the BOPIS segment, (Buy Online, Pickup In Store) as customers and merchants both try to accommodate with the needed social distancing norms. The prime vulnerability in the BOPIS segment is the end delivery point, since there have observed inconsistencies in verifying the information against who has purchased the commodities. Frauds as such are on the rise in regions that are still under lockdown. Mobile orders have seen as prime victims in the increasing rise of account takeover attacks

Fraudsters have been using multiple attack vectors to hamper the security overtime. While initial activities involved were meant for information gathering, actors have stepped up and started verifying the compromised credentials as valid. News accounts are made and kept dormant with the merchants and overtime create an illusion of being a longtime customer. They make them fall under the category of more relaxed fraud strategies, trying to build trust and credibility, which actually makes it difficult for the analysts to differentiate it from genuine accounts.

These observations spotlights the fact that how organized and sophisticated the fraud regines are and while the world is dealing with the pandemic, new actors are on the rise to make a quick buck even in these situations and considering the ongoing situations the fraud activities can only be expected to rise since the world and economy has shifted online for a major portion of their operations.

AI and ML in fraud mitigation.

Adaptation of AI based anti-fraud systems have increased, but it has also been observed that technology alone cannot be relied on against payment frauds. In times where the customer buying pattern changes rapidly, it is difficult to stick on one logic or strategy.

Let’s take a look at the travel industry, normally the last minute purchase of a one way ticket is flagged as high risk, but the COVID-19 showcased the surge in the purchase of tickets at that particular time even before restrictions took effect. The increasing activities of using Amazon vouchers and other gift cards which are cash redeemable.

These incidents have mirrored the need of a multi layered fighting approach which the technologies are clubbed with a rule-based strategy. Since AL and ML require established pattern recognition to detect fraudulent transactions, a rule based strategy enables the business to set the context and define parameters. Relying alone on the ‘black box’ of an AI / ML technology can be dangerous, we require an explanatory and context based approach or XAI the upcoming generation of AI models.